Hi, Quoting Benjamin Drung (2026-10-13 19:03:50) > > Quoting Benjamin Drung (2026-06-25 11:10:37) > > > I thought about it. We should handle security.ubuntu.com separately. It > > > might > > > be useful to use resolute-security from the mirror that you specified and > > > have security.ubuntu.com as fallback. So > > > > > > ``` > > > mmdebstrap --suites="%s %s-updates %s-security" resolute resolute.tar > > > http://my.mirror.example/ubuntu > > > ``` > > > > > > would create: > > > > > > ``` > > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > > http://my.mirror.example/ubuntu resolute main > > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > > http://my.mirror.example/ubuntu resolute-updates main > > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > > http://my.mirror.example/ubuntu resolute-security main > > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > > http://security.ubuntu.com/ubuntu resolute-security main > > > ``` > > > > > > What do you think? > > > > is the main purpose of the --suites option with %s placeholders you propose > > to > > add security mirrors? > > No. This request is unrelated to the security mirror. The purpose is to > ease selecting what to use. I have these use cases: > > * Build an Ubuntu chroot that is equivalent to the Ubuntu builders for > normal uploads, i.e. have --suites="%s %s-updates %s-proposed" plus the > security pocket.
I was looking online what a Ubuntu pocket is but the results talk about the GPD Pocket. Is what you call pocket just an apt source? > * Build an Ubuntu chroot for security builds, i.e. have --suites="%s" > plus the security pocket. > > Sometimes it's useful to test with the updates pocket enabled, but the > proposed pocket disabled. And some might want to add the backports > pocket. > > To reduce the load on http://security.ubuntu.com/ubuntu/ I want to have > the security pocket served by http://security.ubuntu.com/ubuntu/ but > also from my local mirror. Thank you for listing your use-cases. I would like to understand them to better think about the best interface to support them. Are you running mmdebstrap from the command line or do you run it from a script? > > If mmdebstrap would automatically add security and updates suites for a > > Ubuntu > > stable release, which use-case for the --suites option would remain and > > would > > the remaining use-case warrant a new option? > > Always adding the updates pocket is not always what users might want. Yes, for any "sensible default" there must be a way to opt-out of it and do some custom thing. Right now, for mmdebstrap the mechanism is to use the SUITE parameter to select a distro name and then mmdebstrap will try to do the "sensible thing" for that distro, like adding the security mirrors for Debian stable releases. If you don't like that, you can add your own apt sources and do whatever you like. > My proposal would be to make the pockets configurable and always add the > security mirror. So for the modern deb822 format it would be this: > > ``` > Types: deb > URIs: $mirror > Suites: $suites > Components: $components > Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg > > Types: deb > URIs: http://security.ubuntu.com/ubuntu/ > Suites: ${series}-security > Components: $components > Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg > ``` I would like to brainstorm more about a good interface for this. I think your motivation for adding the --suites parameter with a %s placeholder comes from the assumption that distros generally name their suites in a certain pattern and otherwise share the same mirror url signed with the same keyring. In such a situation your idea with --suites would indeed work well. But since I am approached by other derivative maintainers, I have been thinking about other ways to maybe implement what you want and I am rather leaning into the direction used by sbuild. So instead of adding another option, how about pimping the SUITES option? I like the idea to always add the appropriate security mirror. I think that is a sensible default and if you want to do your own thing, you can just pass your own apt sources. That being said, how about making it such that you can for example pass resolute-updates as the SUITE parameter and then you get a ubuntu chroot with resolute-updates and resolute-security. If you pass resolute-proposed, you get a chroot with resolute-updates and resolute-security. It would be up to people familiar with the derivative to choose fitting mappings from SUITE name to set of apt sources and care has to be taken to not introduce conflicts between distros but given how debootstrap seems to manage just fine despite the huge number of codenames it already supports, I think this could be managed. What do you think? Thanks! cheers, josch
signature.asc
Description: signature
